RootBounty is not a registered company yet. For now it is a website run by its founder as an individual. When the company is incorporated, this document will be updated with its legal name, tax ID and registered office, and you will be asked to accept the new version. Until then, the rights and obligations described here are those of the person who runs RootBounty.
Found a vulnerability in RootBounty itself — this website, the API, the admin panel or the documentation? Tell us first and give us time to fix it.
How to report
Write to security@rootbounty.com with what you found, where, and the steps to reproduce it. We acknowledge within 3 working days and keep you informed until it is fixed.
Rules
- Test with your own accounts. Do not read, change or delete other people's data; stop as soon as you can prove the issue.
- No denial of service, spam, social engineering or physical attacks.
- Keep the details private until we confirm the fix.
Safe harbor
We will not take legal action against research done in good faith under these rules.
Recognition
RootBounty does not pay bounties for its own platform yet. With your permission we credit you publicly.